When mentoring I have often found that sessions offer one of the least understood areas for some Java developers.  This may be because sessions are not covered well in colleges but either way, I have found the following three nuggets to be useful.

I will cover getting, setting and removing attributes from sessions.  Each session has a HttpSession object which provides means of storing values in name-value pairs.  You don't have a HttpSession object by default, but they are easy to create and access.

session.setAttribute()

ses = request.getSession(true);
ses.setAttribute("Name","Value");

or

request.getSession(true).setAttribute("Name","Value");

 In the example above I used the request.getSession method to return a session object.  The true value is optional and offers to create a session object if none exists.  Alternative values for this are getSession(false) which will return a session only if one exists and no value getSession() which is equivalent to getSession(true).

The setAttribute() method allows you to specify a name first and a value secondly and will set it in the session.  I have shown two ways of accomplishing this as the dot operator allows you to consolidate the getSession and the setAttribute into one statement.

session.getAttribute()

When you want to get an attribute value saved in a session you can retrieve it using the attribute name.  By passing the name in the getAttribute method you will return the value.  But in the case where you have saved more than one attribute or you are unsure as to the name and would like to return them all the session object provides a mean of achieving this also.

//for a single attribute
<%=>

//for multiple attributes
<% enumeration="" names="request.getSession(false).getAttributeNames()" while="" string="" attrname="(String)names.nextElement()">
	Name:  <%= attrname="">
	Value: <%= attrname="">
<%>

<%=><% enumeration="" names="request.getSession(false).getAttributeNames()" while="" string="" attrname="(String)names.nextElement()"><%= attrname=""><%= attrname=""><%>

In the code above I access the single value directly but in the second I retrieve an Enumeration of the attribute names associated with the session.  I then iterate through the elements retrieving each attribute name and retrieve the associated value.

session.removeAttribute()

When I close a session such as when a user logs out of a website I prefer to close the session softly.  I remove the attributes in their session, reduce the max interval to lowest possible and then invalidate the session.  In this way you are clearing the session of all the elements and if in the future you want to save the users session to have it returned when they log back in it is a minor edit to your existing code. As with getAttributes() you removeAttributes takes the attribute name and then removes them from the session. You can bulk remove the attributes from the session using the same getAttributeNames() and then iterating through the Enumeration removing them one by one.

request.getSession(false).removeAttribute("Name");

I hope this proves useful to you.  If you have any questions don't hesitate to leave a comment or email support[@]tomred.net